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1 . (currently amended) In a distributed network having a number of server computers and 
associated client devices, a network virus defense system, comprising: 

a network virus/worm sensor operable in a number of modes arranged to delect a 
computer virus or a computer worm in the network such that the bandwidth of the network is 
substantially unaffected in a first mode in ihat da t a packets are n ot removed from or added to 
network traffic, but are copied, and v yhprcin when the virus sensor detects the computer virus, the 
vims sensor switches to a second m o de, wherein the data packets are not copied and wherein a 
subset of data packets determined to be infected or suspected of be ing infected are not returned 
tp the petwork; emd 

a network virus sensor self registration module coupled to the network vims/worm sensor 
arranged to automatically self register the associated network virus/worm sensor 

a controller storing a rules engine used to store and source a plurality of detection rules 
for detecting computer viruses and worms and using statistical results.; 

a server for virus cleaning agents from known viruses and unknown viruses subsequently 
analyzed; and 

an anti-virus agent creation module arranged to create an anti-virus agent or create a 
detection module, an infection module and a pavload . 

2. (original) A system as recited in claim 1 , wherein during an initialization 
phase of the network virus/worm sensor, the network virus/worm self registration module 
collects selected network environmental information and network configuration information. 
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9. (original) A system as recited in claim 7, wherein during the initialization 
phase, each of the outbreak prevention policy distribution and execution engines associated with 
each of the identified controllers are updated with a set of ami- virus policies, a set of anti-virus 
protocols, and a set of anti- virus procedures. 

1 0. (currently amended) A system as recited in claim 1 , wherein in a first mode the 
bandwidth of the network is substantially unaffected by the network virus/monitor sensotjhe 
network virus/monitor sensor not removing or adding network traffic but copying data packets, 
and wherein when the network virus/worm sensor detects a computer virus or a computer worm, 
the virus/worm sensor switches to a second mode such that only those data packets infected by 
the computer virus arc not returned to the network. 

1 1 . (currently amended) In a distributed network having a number of server 
computers and associated client devices ami a network virus/monitor sensor operable in a 
nu mber of modes , a method of self registering a network virus defense system comprising : 

that-ma ludcs a network virus/worm -sensof-ep crablo in a number of modes arranged to 
detect- detecting a computer virus or a computer worm in the network such ft&t bandwidth of the 
network is mihgtantiallv unaffected in a first mode i n that data packets are not removed from or 
added to network traffic, bat are copied, and wherein when ihe virus sensor detects the computer 
virus, the vimft sensor swirches to a second mode, wherein th e data packets are not copied and 
w ^rein a subset of data packets determined 10 be infected or suspect ed of being infected are not 
returned to the network , c omprisin g: 

automatically self registering ihe as5eoiated^teiv^-vk^Ave«« sensor by a network 
virus sensor self registration module coupled to the network virus/worm sensor; 
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storing a rules cnpine used to store and sou r ce a plurality of detection roles from 
detecting computer viruses and worms and using statistical results 

providing virus cleaning agents from known viruses and unknown viruses subsequently 
analyzed; and 

creating a detection module t hat detects whether a client device is infected w ith a virus 
and triggers the inn-oduction of an anti-virus infection module so that the virus in the client 
device is overwritten and an anti-virus agent pavload created based on features of the selected 
computer virus and performs as a clcaninp/repairing pavload capable of cleanin g and repairing 
damage done to the client device. 

12. (currently amended) A method as recited in claim 1 1 f further comprising: 
during an initialisation phase of the network virus/worm sensor , collecting selected 

network environmental information and network configuration information by the network 
virus/worm self registration module. 

13. (currently amended) A method as recited in claim 1 2, wherein when the 
distributed network is an IP based type network, the selected network environmental information 
includes an IP address for all of the relevant client devices included in the IP-based type 
network. 

1 4. (original) A method as recited in claim 13, wherein the network 
configuration information includes self configuration information related to an appropriate IP 
address for the network virus/worm sensor. 
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